The short version
C2PA is the Coalition for Content Provenance and Authenticity, and the technical specification that coalition publishes. A conforming file can carry a manifest: issuer, actions (created, edited, opened), and cryptographic signatures so a reader can check whether that package still matches the bytes. The coalition’s public home is c2pa.org; the current published specification (2.4) is at spec.c2pa.org. Checked again on 25 October 2026, that homepage still uses this name, still calls the standard Content Credentials, and the “Adopt the spec” link still points at specification 2.3.
Adobe, camera makers, and some generative-image pipelines implement pieces of this. Implementation quality varies. A file with no C2PA packet is the normal case, not a confession.
How it shows up in files
JPEG often uses JUMBF in APP11. PNG may use a caBX chunk. Some MP4 files use UUID boxes. You do not need those names to use a viewer. You do need them if you are debugging why a platform “lost” the credential after a recompress.
On this site, the Content Credentials checker first reads JUMBF / caBX (and related boxes) in the browser and does not upload the file. If a file has a packet, you can read issuer, actions, and model-adjacent strings here. The narrower entrance is the C2PA viewer online, which opens the same inspector. Official OpenAI provenance verification is a separate, optional click; that path does send the original bytes. A missing packet is inconclusive: it does not prove a human took the photo, and it is not a guarantee about any social-app label.
What it is not
- Not EXIF. Comparison: C2PA vs EXIF.
- Not the whole idea of content provenance. C2PA is one signed standard for that record. Content provenance.
- Not the same word as Content Credentials, though they are tightly related. C2PA vs Content Credentials.
- Not a guarantee a social app will show an AI label — or that it will not.
- Not proof of “human” when missing. Missing is inconclusive.
Actions you may see
Manifests can distinguish a file created from scratch by a generative tool from a photograph that was later inpainted. That distinction matters because some platforms have treated many “algorithmic” signals as one “Made with AI” badge. The file can be more specific than the badge.
What the specification puts in a manifest
C2PA Technical Specification 2.4 describes assertions as statements about creation, edits, the device, or bindings. Those assertions are wrapped into a claim. The claim generator digitally signs that claim on behalf of the signer, which produces the claim signature. Assertions, the claim, and the claim signature together are a C2PA Manifest. The set of manifests stored in the asset is its Content Credential, which the spec also calls the manifest store.
The same specification says it should not make a value judgment about whether provenance is “good” or “bad.” A reader checks whether the assertions validate as associated with the asset, are correctly formed, and are free from tampering. A missing manifest is outside that check. The spec describes validation of a manifest that is present. It does not treat absence as proof a person made the picture.
The specifications index fetched on 21 October 2026 is labeled C2PA Specifications 2.4 and lists versions from 1.0 through 2.4: spec.c2pa.org 2.4. The technical document used below is C2PA Specification 2.4. The coalition homepage fetched the same day still links the 2.3 technical specification from “Adopt the spec,” not the 2.4 URL: c2pa.org. That homepage calls Content Credentials an open technical standard “for publishers, creators and consumers to establish the origin and edits of digital content,” and says they “function like a nutrition label.” Its steering-committee image labels are Adobe Inc., Amazon, BBC, Google LLC, Meta Platforms, Inc., Microsoft Corporation, OpenAI Inc, Publicis Groupe, Sony Group Corporation, TikTok Inc., and Truepic, Inc.
Where JPEG and PNG store it
The manifest store uses a JUMBF superbox with the label c2pa and the type UUID 63327061-0011-0010-8000-00AA00389B71. For a JPEG, specification 2.4 says the APP11 marker (FFEB) and the segment length of every APP11 segment that holds the JUMBF are included in the hash exclusion range. For a PNG, the chunk type is caBX, and both the chunk length and the type are included in that exclusion range.
Those names matter when a recompress drops the box. They are not something you have to type. The AI Image Origin Detector looks for those boxes in the browser. The C2PA viewer opens the same inspector.
Actions specification 2.4 names
In the 2.4 actions list, c2pa.created means “The asset was first created.” For an asset that is created, the first actions assertion in the claim’s created assertions must start with c2pa.created, and that action must carry a digitalSourceType. If the asset is created with no digital content, that field is http://c2pa.org/digitalsourcetype/empty. The spec’s generative-AI example uses http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia on a c2pa.created action.
c2pa.opened means “An existing asset was opened and is being set as the parentOf ingredient.” A standard manifest contains no more than one action whose type is c2pa.created or c2pa.opened. The empty-canvas example also uses c2pa.placed for each imported photo. Seeing c2pa.created is not the same sentence as “a camera took this.” The digital source type on that action is the part that says how the file began.
How to read a file with the detector on this site
Open the AI Image Origin Detector. The drop area is labeled “Upload a PNG, JPEG, or WebP image.” The heading says “Drop a PNG, JPEG, or WebP,” and the button says Choose image. You can also paste an image. The other control is Try a sample, which loads “Spring with Flowers” by Larisa Koshkina, dedicated under CC0 1.0. The sample note on that control says those bytes do not contain a C2PA manifest, and that the absence is inconclusive.
The local pass stays in the browser. The result panel says the first check only reads data the browser can see, and that a missing C2PA box does not mean C2PA never existed or that a person made the image. The local explanation used by the tool calls this pass an inspector, not a cryptographic C2PA validator. It can report container structure, digital source types, and editing actions when those bytes are still in the file. It cannot detect SynthID.
Official OpenAI verification is the button Verify with OpenAI. The card says that check sends the selected image to OpenAI through CreatorPrivacyKit’s server, and that the local inspection above does not upload the file. Do not press it if the file must not leave the device. The Image URL tab is separate: Fetch & Analyze temporarily fetches a direct image URL through the Worker. The note on that form says the image is not stored.
Read the signer, the actions, and any digital source type the local pass printed. Then decide whether you still have the original file. A screenshot is a new file; the container credential usually does not come with it. That split is written up in what survives a screenshot. The click-by-click field note is how to check Content Credentials.
What this check does not decide
- A missing packet does not prove a human took the photo. Missing is inconclusive.
- The local inspector does not validate the signer’s certificate chain. Cryptographic validation is a different job from listing the boxes that are still in the file.
- The local inspector cannot detect SynthID. SynthID, when it is checked at all, is the optional OpenAI request.
- The specification’s own rule is that a valid manifest is not a moral score. This page does not add an AI percentage.
- A platform label can still disagree with the file. Instagram, Facebook, TikTok, and YouTube can label from self-disclosure or their own detection as well as from credentials.
c2patool and the verify site
The c2patool README, as read on 21 October 2026, describes a command-line program for C2PA manifests and media files. It can read a summary JSON report, read a low-level report, and add a manifest to a file. Installation notes on that page include brew install c2patool on macOS and prebuilt archives for macOS, Windows, and Linux. This site’s detector does not add a manifest and does not shell out to c2patool. This site did not re-test c2patool’s output.
The Content Credentials site links a verify tool at verify.contentauthenticity.org. That page did not return a readable description of its controls when it was fetched on 21 October 2026, so this article does not describe its buttons. Use it when you want that project’s own checker, and keep the file’s upload terms in mind. The in-browser path on this site is the detector above.